Black-box watermarking uses backdoor attacks to force an ML model to remember specific patterns or features [1]}, [2]}, [3]}. The backdoor attack causes the ML model to misclassify when encountering samples in the trigger set. The model owner keeps the trigger set secret and can thus verify the ownership of the model by triggering a misclassification.
